Better checking for api sort param to prevent sql injection

And moved filters out and cached object reflection

backend/internal/api/middleware/expansion.go

@@ -9,7 +9,7 @@ import (
 )
 
 // Expansion will determine whether the request should have objects expanded
-// with ?expand=1 or ?expand=true
+// with ?expand=item,item
 func Expansion(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		expandStr := r.URL.Query().Get("expand")